formbook | b708155f8a66c0542f73d26155c6dff36ec4d180aaa05f5272a409f2c7a98e89

Analysis

max time kernel
103s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2025, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b708155f8a66c0542f73d26155c6dff36ec4d180aaa05f5272a409f2c7a98e89.exe
Size 1.2MB
Sample250707-r2pmqaem41
SHA256 b708155f8a66c0542f73d26155c6dff36ec4d180aaa05f5272a409f2c7a98e89
MD5 0194a934782b2646e296e61b1ad304b5
SHA1 928cde25358b9039f48e10b13af68ea9478765b9
SHA512 c522e8f1145872d3fac31445f9aece1026098803d515bdd12692d98aecef7a8679474ffda09f9213b9eeb240fec1450449cad5fb708040a863366f733a8f6663
SSDEEP 24576:ctb20pkaCqT5TBWgNQ7a/zSF/g0+FJFweWNKv8iN6A:FVg5tQ7a/I+XGeNv8C5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook discovery rat spyware stealer trojan

Malware Config

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/5680-16-0x0000000000400000-0x0000000000449000-memory.dmp	family_formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5144 set thread context of 5680	5144	b708155f8a66c0542f73d26155c6dff36ec4d180aaa05f5272a409f2c7a98e89.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3764	5144	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b708155f8a66c0542f73d26155c6dff36ec4d180aaa05f5272a409f2c7a98e89.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5680	svchost.exe
5680	svchost.exe
5680	svchost.exe
5680	svchost.exe
5680	svchost.exe
5680	svchost.exe
5680	svchost.exe
5680	svchost.exe
5680	svchost.exe
5680	svchost.exe
5680	svchost.exe
5680	svchost.exe
5680	svchost.exe
5680	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5144	b708155f8a66c0542f73d26155c6dff36ec4d180aaa05f5272a409f2c7a98e89.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5144	b708155f8a66c0542f73d26155c6dff36ec4d180aaa05f5272a409f2c7a98e89.exe
5144	b708155f8a66c0542f73d26155c6dff36ec4d180aaa05f5272a409f2c7a98e89.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5144	b708155f8a66c0542f73d26155c6dff36ec4d180aaa05f5272a409f2c7a98e89.exe
5144	b708155f8a66c0542f73d26155c6dff36ec4d180aaa05f5272a409f2c7a98e89.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5144 wrote to memory of 5680	5144	b708155f8a66c0542f73d26155c6dff36ec4d180aaa05f5272a409f2c7a98e89.exe	88
PID 5144 wrote to memory of 5680	5144	b708155f8a66c0542f73d26155c6dff36ec4d180aaa05f5272a409f2c7a98e89.exe	88
PID 5144 wrote to memory of 5680	5144	b708155f8a66c0542f73d26155c6dff36ec4d180aaa05f5272a409f2c7a98e89.exe	88
PID 5144 wrote to memory of 5680	5144	b708155f8a66c0542f73d26155c6dff36ec4d180aaa05f5272a409f2c7a98e89.exe	88

C:\Users\Admin\AppData\Local\Temp\b708155f8a66c0542f73d26155c6dff36ec4d180aaa05f5272a409f2c7a98e89.exe
"C:\Users\Admin\AppData\Local\Temp\b708155f8a66c0542f73d26155c6dff36ec4d180aaa05f5272a409f2c7a98e89.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5144
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\b708155f8a66c0542f73d26155c6dff36ec4d180aaa05f5272a409f2c7a98e89.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5144 -s 704
  2⤵
  - Program crash
  PID:3764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5144 -ip 5144
1⤵
PID:2524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aut5A74.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut5A74.tmp
Size 289KB
SHA256 bfdbccdf52a4bbe6c205ee5de6a41831c31516d1da0ca06fb0d2d728b115c918
MD5 c0b4c123c7a504fd48e01c77f4a75d6b
SHA1 9451057993044f5bad5266eb750af81aa00c4d27
SHA512 a3d6ceca207d582e92fba5f06b44cc59da0a2ad19b92dd9c247f15c3d406429792a5fc0b2c70b3f5447a6568addfd2e2e21227002107ba319223d7f9bc34bc25
SSDEEP 6144:8XUXK02ins+cDwHsLLBSILMIzQgL2PL9yRyhax2GyistZ92GQ:8Eh2is+SAIzQ4TyristZ92GQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5144-12-0x0000000000D40000-0x0000000000D44000-memory.dmp

Download

memory/5680-13-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/5680-14-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/5680-15-0x0000000001000000-0x000000000134A000-memory.dmp

Download

memory/5680-16-0x0000000000400000-0x0000000000449000-memory.dmp

Download